The present invention relates generally to detecting event occurrences, and more particularly to method and apparatus that detect when a certain number of events occur within a time frame.
Computer systems commonly need to perform actions in response to a defined condition being satisfied. In particular, a computer system may need to perform certain actions in response to a particular event occurring a certain number of times within a specified time frame. For example, it may be desirable for a computer system to deactivate a user account in response to detecting that more than five bad login attempts have been made within a ten minute time frame.
Some known computer systems detect whether a particular event occurs a certain number of times within set time intervals. To this end, these known computer systems define time intervals based upon a time frame of interest and count the number of events that occur within each defined time interval. For example, these known computer systems may split an hour into six separate 10 minute intervals and determine based upon the number of events within each 10 minute interval that the event occurred more than a desired amount of times within a single 10 minute interval.
While this scheme works well in some instances, the scheme does not detect whether the event occurred more than a desired number of times within a specified time frame. Referring to the above example of six 10 minute intervals, if the event occurred 3 times within the last 3 minutes of a first 10 minute interval and occurred 3 times within the first 3 minutes of a second 10 minute interval, the known computer systems would not detect that the event occurred more than 5 times within a 10 minute time frame that spanned the last 3 minutes of the first 10 minute interval and the first 3 minutes of the second 10 minute interval.
Moreover, known computer systems track event occurrences by maintaining software variables whose values are stored in volatile memory. Since it may be desirable to perform actions in response to a certain number of events occurring within a relatively long time frame that may spans days, weeks, or even months, there is a high likelihood that the known computer systems would lose count of events due to (i) the computer system being powered down or restarted, or (ii) the software service that tracks the events being shut down or restarted.
Accordingly, there is a need for a method and apparatus that determine whether a particular event has occurred a certain number of times within a specified time frame that is not limited to set time intervals. Moreover, there is a need for a method and apparatus that may reliably determine whether a particular event has occurred a certain number of times within a relatively long time frame.